Emsisoft Blocks 100% in AVLab’s Latest Advanced In-The-Wild Malware Test

AVLab has published the September 2026 edition of its Advanced In-The-Wild Malware Test. The headline numbers for Emsisoft Enterprise Security + EDR are short and clean. It blocked 417 of 417 samples, a 100% rate, and earned EXCELLENT certification.

What the test measures

AVLab runs six rounds per year against live malware. Samples come from active URLs, public threat intelligence feeds, and honeypots. Each one is deduplicated by SHA-256 hash, checked with static YARA analysis, and executed dynamically on Windows 11 to confirm it is malicious before testing begins.

Protection is measured at two levels. Web-Layer Protection stops a threat at the URL or download stage. Runtime Defense stops it after code has executed, which is where zero-days and fileless attacks live. AVLab renamed these levels in January 2026. Older reports call them Pre-Launch and Post-Launch.

The third metric is Remediation Time. It counts the seconds from the moment malware enters the system through the browser until the product has neutralized it and restored the system. A product only has a Remediation Time if something reached execution and needed cleaning up. That detail matters when you read the results table.

EXCELLENT certification requires at least 99.6% of samples blocked through effective web-layer and runtime defense, including automated remediation. Products are configured according to vendor recommendations, and those configurations are published. Emsisoft was tested with default settings, automatic PUP repair, EDR active, Rollback enabled, and browser protection engaged.

The testing field

Sixteen products entered this round. Ten finished with a perfect 100% block rate. Six allowed at least one full system compromise.

Across the field, the average product stopped 81% of samples at the web layer and 5% at runtime. Remediation times varied widely among the products that had runtime work to do. Emsisoft averaged 3.365 seconds. The field averaged 6.19 seconds.

A snapshot of Emsisoft’s results:

The threat landscape this round

The samples again leaned heavily on Living off the Land binaries, the trusted Windows components attackers abuse to blend in. The most invoked were svchost.exe with 11,219 invocations, explorer.exe with 2,920, rundll32.exe with 2,374, sh.exe with 1,491, certutil.exe with 1,439, and powershell.exe with 436.

Delivery ran 222 samples over HTTP and 22 over HTTPS. Compromised .com domains accounted for nearly all of the malicious URLs. Samples left unprotected averaged 141 malicious changes to the system each, which is what the runtime layer is up against when the web layer misses.

About the lab

AVLab Cybersecurity Foundation is an independent testing laboratory that has evaluated security products since 2012. It is a member of AMTSO and a participant in the Microsoft Virus Initiative. It publishes product configurations alongside results and keeps an open archive of every past round.

What it means for Emsisoft Enterprise Security + EDR

A 58.75% web-layer share means Emsisoft’s first line of defense left more work for the later layers than several competitors did. The September results show those layers finishing the job without human involvement. The documented incident lays out the sequence.

An EDR log entry two milliseconds after the launch attempt. No malware process observed. Quarantine written seconds later. Detection and cleanup happened as one automated motion, under a default configuration.